Is CVE-2026-6401 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6401 being exploited in the wild.

How severe is CVE-2026-6401?

Medium severity, with a CVSS score of 4.3, published 20 May 2026.

Which products and versions are affected?

Bottom Bar up to and including 0.1.7.

Is there a fix for CVE-2026-6401?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-6401 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6401?

Check whether you run Bottom Bar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6401: WordPress Bottom Bar CSRF in settings update

CVE-2026-6401 · Severity: medium · CVSS 4.3 · Published 2026-05-20

The Bottom Bar plugin for WordPress, which adds a customizable navigation or information bar to websites, contains a security flaw that allows unauthorized configuration changes. By tricking a site administrator into clicking a malicious link, an attacker can remotely modify plugin settings such as language options or enabled sharing services. This could lead to unauthorized changes in how the website appears or functions for its visitors.

Quick answers

Is CVE-2026-6401 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6401 being exploited in the wild.
How severe is CVE-2026-6401?: Medium severity, with a CVSS score of 4.3, published 20 May 2026.
Which products and versions are affected?: Bottom Bar up to and including 0.1.7.
Is there a fix for CVE-2026-6401?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-6401 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6401?: Check whether you run Bottom Bar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Bottom Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing nonce verification in the bottom-bar-admin.php file. Specifically, the main settings, sharing services, and restore defaults forms lack wp_nonce_field(), and the server-side processing fails to implement check_admin_referer() or equivalent validation before executing update_option(). An unauthenticated attacker can exploit this by inducing a logged-in administrator to submit a specially crafted POST request. Successful exploitation allows the attacker to modify plugin configuration options, including language settings and sharing service visibility.

Affected products

WordPress Plugin Bottom Bar up to and including 0.1.7

Timeline

2026-05-20: disclosed: Initial advisory publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.